If your organisation provides services to an entity that have an effect on the entity's financial statements, then you may be asked to provide a report on internal control for the benefit of the entity's management and their financial statement auditors. A SAS No. 70 audit will be your solution. SAS No. 70 is a formal report on the design, implementation, and operating effectiveness of controls at a service organisation.
Conversely, if your company outsources some or all of its business operations to a service organisation, and these operations have an affect on your financial statements, then a SAS No. 70 audit report may provide you and your independent auditors information about the service organisation’s control environment, their related control objectives, and their affect on your financial statements.
The following business functions are often outsourced and performed by a service organization:
- Finance and Accounting
- IT Data Center
- Transfer Agent
- Investments and Funds Accounting
- Payroll
Entities that use service organisations and are registered with the U.S. Securities and Exchange Commission (SEC) are now required to comply with Sarbanes-Oxley regulations. When they have outsourced key financial processes or underlying IT applications and infrastructure to a service organization, they will need to obtain assurance as to the design and operating effectiveness of the controls over these processes. SAS70 is now a principal tool for companies receiving third party services that impact financial reporting controls or internal control environment to provide evidence that controls are in place both within the third party provider and between the two organisations.
For organisations providing transaction processing for their customers, SAS 70 report including independent auditor opinion is an effective method of communication that internal control over systems and processes are suitably designed and are operating effectively within a well-controlled environment. Such formal communication has recently become an important success factor when differentiating between service organisations and demonstrating ability to achieve high quality performance.
A SAS No. 70 report:
- Type 1 report where the auditor opine on fair presentation of service organization’s description of controls, suitability of controls design and whether controls were placed in operation as of a specific date.
- Type 2 report where the auditor additionally opine whether the controls tested were operating effectively over a period of usually not less than six months.
- Is used to support the financial audit process of entities that use service organisations and to provide assurance that internal control over outsourced systems and processes are suitably designed and are operating effectively within a well-controlled environment.
- Contains a description of the service organisation’s control environment, its control objectives, and the key controls that are in place to achieve those control objectives.
- Contains tests of operating effectiveness performed by the independent accountant, and the results of those tests.
- Contains control considerations that should be employed at entities that use the service organisation.
- Is intended for use by the service organisation, its customers, and the independent accountants of its customers.
PricewaterhouseCoopers Poland has significant experience in delivering SAS 70 engagements in Poland for major business process outsourcing centres, including client specific SAS 70 reviews, agreed-upon procedures and readiness reviews as well as assessments of common controls at the shared service centre level.
Krzysztof SzuldrzynskiPartner
Assurance and Advisory
krzysztof.szuldrzynski@pl.pwc.com
+48 22 523 4103
Piotr UrbanSenior Manager
Assurance and Advisory
piotr.urban@pl.pwc.com
+48 12 429 6100
